feat(P04): PAT lifecycle + nova auth login/revoke/status (REQ-342..344, C-7.3, security+cli)

---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: cli-engineer
---

core/lambda/nova_idp_token_vend.py

@@ -238,13 +238,23 @@ def vend_token(
     ``_DeniedError`` (→ 403) on revocation / ABAC denial.
     """
     requested_claims = requested_claims or ["sub", "roles"]
-    target_resource = target_resource or {"type": "contract", "id": "*", "owner": "*", "environment": environment or "dev"}
     environment = environment or "dev"
 
     # 1. Decode the PAT/session (without verifying — D-229).
     pat_claims = _extract_pat_claims(token)
     jti = pat_claims["jti"]
 
+    # Default target_resource: owner inherits from the PAT subject so
+    # the owner-matches ABAC rule passes for same-tenant vends. Callers
+    # can override with an explicit target_resource.
+    if target_resource is None:
+        target_resource = {
+            "type": "contract",
+            "id": "*",
+            "owner": pat_claims.get("owner", "*"),
+            "environment": environment,
+        }
+
     # 2. Revocation check (D-229, strong read).
     active, reason = _check_pat_active(jti)
     if not active: